Lucy Buecking

Product Manager

lucy buecking

Digital wireframe illustration of two hands shaking, symbolizing mutual trust and secure authentication between two parties.

What Is mTLS? A Guide to Mutual TLS Certificates

Mutual TLS (mTLS) is becoming a critical component for IT and security teams as the industry moves toward stricter certificate role separation ahead of the March 2027 Chrome Root Program changes. Traditional TLS authenticates only the server, leaving a gap around client identity that attackers can exploit. mTLS closes this gap by requiring both client and server to present unique certificates, enabling true mutual authentication. The shift away from certificates that combine serverAuth and clientAuth EKUs means organizations must begin separating these roles now or risk operational disruption as certificates using dual EKUs lose trust in major browsers. This transition aligns with a broader industry move toward single‑purpose certificate hierarchies for clearer governance and reduced misuse. mTLS is best suited for environments where machine‑to‑machine trust, zero‑trust architectures, regulatory requirements, and strong identity assurance are mandatory. It differs from API keys and OAuth by authenticating at the transport layer and proving the identities of both endpoints cryptographically. Implementing mTLS requires careful PKI planning, correct protocol configuration, and robust lifecycle management, especially at scale and in preparation for post‑quantum cryptography. Organizations should begin auditing where client and server roles currently overlap, plan for dedicated certificate issuance paths, and address configuration gaps early. Taking action now positions teams for a smooth transition before the 2027 deadline.
• Lucy Buecking
PKI Best Practices
Abstract digital security illustration with a checkmark symbol over layered data blocks, representing verified identity, trust, and compliance in TLS certificates

Is Your Identity Verifiable? What the SC-87 Ballot Means for Your Certificates

SC‑87 introduces stricter rules for how Certification Authorities record legal identity data in TLS certificates, requiring the serialNumber field to exactly match a verified Registration Number or, when unavailable, a standardized Date of Formation by mid‑2027. The ballot outlines clear handling for Government and Non‑Commercial Entities and mandates ongoing validation of acceptable formats, closing longstanding gaps in identity vetting. For relying parties, this means clearer, more consistent certificate identity fields and reduced risk of misrepresentation across jurisdictions. CAs must update tooling and RA processes ahead of enforcement, but the result is stronger governance and improved trust signals on the public internet.
• Lucy Buecking
TLS Certificate Standards
world map made up of cybersecurity locks

What Is a Digital Certificate? A Beginner's Guide

Digital certificates are the core mechanism for proving identity, encrypting data, and ensuring integrity across online interactions. They underpin secure websites, email encryption, digital signatures, healthcare compliance, government access and software authenticity. Built on PKI and issued by trusted Certificate Authorities, they provide legal weight, operational efficiency and scalable security — but they also introduce challenges around lifecycle management, correct certificate selection, key protection and deployment. Getting started means identifying the right use case, completing identity vetting, deploying certificates securely and managing renewals proactively. As organizations rely more on digital processes, certificates become critical for maintaining trust, preventing impersonation and meeting regulatory requirements. IdenTrust’s long‑standing expertise and compliance frameworks make its certificates a reliable option for securing websites, documents and data at scale.
• Lucy Buecking
Digital Certificates
A close‑up of two people shaking hands, with a digital network graphic and a cityscape blended into the background to represent technology and partnership.

Foreign Account Tax Compliance Act (FATCA) Reporting Made Simple

FATCA reporting through IDES requires financial institutions to use an IRS‑trusted digital certificate, and IdenTrust issues FATCA certificates accepted directly in the IDES enrollment process. Filing entities must pair the IRS public key with their own FATCA certificate, issued entirely through an online application that supports both U.S. and eligible non‑U.S. residents. Certificates can be stored locally or in a browser and are available with one‑ or two‑year validity at Medium Assurance. Once approved, organizations use the certificate to complete IDES enrollment, validate their GIIN, and submit FATCA reports securely. IdenTrust simplifies the process with IRS‑approved credentials that help entities meet FATCA and IDES requirements confidently.
• Lucy Buecking
FACTA Reporting
Illuminated blue checkmark badge signifying a digital certificate.

Validation, Assurance, and Digital Trust in Financial Transactions: DV, OV, and EV TLS/SSL digital certificates

DV, OV, and EV TLS/SSL certificates offer increasing levels of identity assurance, helping organizations align website security with the sensitivity of the transactions they support. DV certificates validate only domain control and are suitable for basic encryption, while OV certificates add verified organizational identity for businesses that need to assert legitimacy and protect brand reputation. EV certificates provide the highest level of assurance by confirming legal, physical and operational existence — essential for e‑commerce, banking, trading platforms and any site handling sensitive financial interactions. Choosing the right certificate type helps protect users, safeguard reputations and establish trust in digital transactions.
• Lucy Buecking
TLS SSL Certificates
hand and stylus signing a digital document

Adobe Approved Trust List (AATL) for Digital Signatures

AATL digital signing certificates let organizations replace paper workflows with trusted, identity‑verified PDF signatures directly in Adobe applications. As businesses shift from B2B to B2C models and require stronger KYC practices, AATL‑approved certificates provide reliable signer identity and legal non‑repudiation, supported by secure hardware storage options like FIPS‑compliant USB tokens and smartcards. Once a document is signed, its validity persists even after certificate expiry, strengthened by IdenTrust’s built‑in timestamping. For companies moving to fully digital contracting and submission workflows, AATL certificates offer a seamless way to verify signers, preserve trust and maintain long‑term document integrity.
• Lucy Buecking
Digital Certificates